'Downloader.EJD' presents itself as a patch to fix the Windows Plug and Play vulnerability.

PandaLabs, a developer of virus and intrusion prevention solutions, today announced that it has detected a new variant of the downloader trojan family - Downloader.EJD, which presents itself as a patch to fix the Windows Plug and Play vulnerability.

According to the company, like most trojans, Downloader.EJD cannot spread by itself, but needs one or several malicious users to prepare and massively distribute the email message that contains the trojan.

This vulnerability was exploited a few days ago by worms Zotob, IRCBot.KC and IRCBot.KD, raising the general virus alert level to orange. These malicious worms attacked such media institutions as CNN, ABC and The New York Times, U.S. Congress, and companies such as Caterpillar. TruPrevent Technologies has blocked this trojan proactively by analyzing its behavior, protecting computers from Downloader.EJD at the moment of attack.

 "This is a new way of exploiting the Plug and Play vulnerability - in this case by making use of social engineering - a strategy already used to trigger significant epidemics in the past. It aims to trick users into running the file received and this can be largely avoided by complementing traditional antivirus programs with proactive technologies like TruPrevent. TruPrevent is capable of detecting new samples of malware by analyzing their behavior, so if the user runs the file that contains Downloader.EJD, TruPrevent Technologies will detect any malicious processes that the Trojan tries to carry out, and block them immediately," said Luis Corrons, director of PandaLabs.